CVE-2026-123997

MEDIUM 6.5

Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

CWE	CWE-770
Vendor	hisense
Product	vidaa
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for hisense vidaa

Be the first to know when new medium vulnerabilities affecting hisense vidaa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

Hisense / VIDAA

0000.01.00a.P0220

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research vulncheck.com: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi

Credits

Yehia Elghaly (Mrvar0x)